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Abstract 

We give a generic divide-and-conquer approach for construct- 
ing collusion-resistant probabilistic dynamic traitor tracing 
schemes with larger alphabets from schemes with smaller al- 
phabets. This construction offers a linear tradeoff between the 
alphabet size and the codelength. In particular, we show that 
applying our results to the binary dynamic Tardos scheme of 
Laarhoven et al. leads to schemes that are shorter by a factor 
equal to half the alphabet size. Asymptotically, these code- 
lengths correspond, up to a constant factor, to the fingerprinting 
capacity for static probabilistic schemes. This gives a hierarchy 
of probabilistic dynamic traitor tracing schemes, and bridges 
the gap between the low bandwidth, high codelength scheme 
of Laarhoven et al. and the high bandwidth, low codelength 
scheme of Fiat and Tassa. 



1 Introduction 

In this day and age of digital technology, protecting digital data 
from unauthorized copying and redistribution is an increasingly 
relevant problem. By embedding unique and imperceptible fin- 
gerprints in each copy of the content, distributors of digital con- 
tent can trace pirated copies to the pirate. However, a more dif- 
ficult scenario arises when several users who have purchased 
a copy collude to form a coalition. When receiving their fin- 
gerprinted content, colluders can compare their copies to detect 
parts of the fingerprints: with the content being the same for all 
colluders, the differences they detect must be part of the finger- 
prints. Then, just assigning unique fingerprints to each user is 
not sufficient anymore, as the colluders may output a forgery 
that does not match any of their copies exactly. For this, we 
need collusion-resistant traitor tracing schemes, consisting of a 
way to assign fingerprints to users, and an algorithm to trace a 
forged copy to the colluders. 

1.1 Model 

Several models have been considered for this fingerprinting 
game. We will focus on the restricted digit model, where for 
each segment of the content, colluders always output one of 
their fingerprinted segments. This means that if all colluders 
received a version with the same fingerprint, they are forced to 
output this version of the content. In the literature, this is usu- 
ally called the marking condition or marking assumption. De- 
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pending on the application, we also consider two different types 
of schemes. In static schemes, for each user, the distributor 
generates all fingerprinted segments at once. After the pirates 
generate a forged copy of the whole content, the accusation al- 
gorithm has to trace this single forged copy to the colluders. In 
this scenario, it is impossible to guarantee that all colluders are 
caught, so we only require that at least one colluder is caught. 
In dynamic schemes however, the content owner is more pow- 
erful, as after every single content segment he can try to catch 
and disconnect pirates, and adjust the fingerprints for the next 
segments based on the previous pirate output. With dynamic 
schemes we are able to catch all colluders, so we only say a 
dynamic scheme is successful if all colluders are traced. 

A further classification of the schemes depends on the notion 
of security we want the scheme to achieve. For probabilistic 
schemes we demand that (i) with probability at most e\ one or 
more of the innocent users are caught, and (ii) with probability 
at most £2 we do not catch at least one colluder (static schemes) 
or all colluders (dynamic schemes). For deterministic schemes, 
we demand that E\ = £2 = 0. 

1.2 Notation 

For convenience, we introduce some more notation. We write 
C for the set of colluders, and denote the number of colluders 
by c = \C\. We write U for the set of all users, and we de- 
note its size by \U\ = n. For each segment i, at most q different 
robust versions can be generated. We denote these by the alpha- 
bet Q = {0, 1, . . . , q — 1}. We denote the number of successive 
segments that the scheme needs by the codelength t. We put 
the fingerprints in a matrix X, where each row corresponds to 
a user j and each column to a segment i. To avoid confusion, 
throughout the paper we will consequently reserve j for index- 
ing users and i for indexing positions or segments. After the 
code matrix X is generated, the colluders get together to form 
a pirated copy y, which due to the marking condition satisfies 
Hi £ {Xj,i : j £ C}. Then, the distributor detects this pirate 
output, and uses some tracing algorithm a on the pirate output 
y and code matrix X to accuse a set of users a(y) = C C U. 
A probabilistic scheme is then successful if P(C' % C) < e\, 
and P{C n C = 0) < e 2 (static schemes) or P(C % C) < e 2 - 



1.3 Related work 

The results in this work are related to probabilistic dynamic 
traitor tracing schemes, but we will also compare our results 
with other dynamic or probabilistic schemes. Fiat and Tassa [7 ] 
describe a deterministic dynamic scheme, using an alphabet of 
size q = 2c + 1 and achieving a codelength of I = c log 2 n + c. 
Since any deterministic (dynamic) scheme requires the use of 
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an alphabet of size q > c + 1, Berkman et al. HI then investi- 
gated whether with q = c + 1 one could also efficiently catch 
all colluders. They showed that this can be done with a code- 
length of I — 0(c 2 + clog 2 (n)). In the area of probabilistic 
static schemes, the scheme of Boneh and Shaw |4| was the first 
breakthrough, achieving a codelength polynomial in the num- 
ber of colluders, with an alphabet size of q = 2. A further im- 
provement was given by Tardos fl4l . who constructed a binary 
(q = 2) scheme achieving codelengths £ = 100c 2 |"ln(n/£i)] . 
This scheme is widely known as the Tardos scheme. Several 
papers ||2][T2][T3] then showed how the constant 100 can be fur- 
ther reduced, and Laarhoven and De Weger [ 10 1 finally showed 
how to achieve the optimal codelength of the binary symmet- 
ric Tardos scheme, given by I = (^- + 0(c _1 / 3 ))c 2 \n(n/ei). 
Building upon this optimal static Tardos scheme, Laarhoven et 
al. ifTTl showed how to construct an efficient binary dynamic 
Tardos scheme, which has the same asymptotic codelength (for 
c — > oo) as the optimal static Tardos scheme, but is able to catch 
all colluders with high probability. This scheme improved upon 
the earlier scheme of Tassa 1 15 1, which uses codelengths quartic 
in c. 

Besides constructions of traitor tracing schemes, several pa- 
pers have also investigated theoretical bounds on the codelength 
needed to catch a certain number of colluders. So far, these 
have all focused on probabilistic static schemes. Tardos lfl4l 
showed that his codelength is optimal up to a constant factor. 
Huang and Moulin [9| gave the exact capacity of the binary 
fingerprinting game, by showing that for large c, a codelength 
of I = 2 ln(2)c 2 ln(n/ei) is both necessary and sufficient. This 
was then extended to the q-ary setting independently by Boesten 
and Skoric |3] and Huang and Moulin [8|, showing that the q- 
ary capacity corresponds to 2 \n(q)-^—^ ln(n/ei) bits of infor- 
mation, or a codelength of i = 21n(2)^-j- ln(n/ei) symbols 
from a q-ary alphabet. 

1.4 Contributions and outline 

In this paper, we give a generic divide-and-conquer approach 
for constructing probabilistic dynamic traitor tracing schemes 
with large alphabets from schemes with small alphabets. This 
construction provides a linear tradeoff between the alphabet 
size q and the codelength £; increasing the alphabet size by a 
factor k leads to codes that are a factor k shorter. This con- 
struction can be applied to any low-bandwidth probabilistic dy- 
namic traitor tracing scheme, and in particular to the (binary) 
dynamic Tardos scheme of Laarhoven et al. ATI . We show 
that for arbitrary (fixed) alphabet sizes q, we obtain schemes 
with codelengths I = (it 2 +0((c/g) _1/3 )) ^ ln(n/ei), match- 
ing the fingerprinting capacity for static q-ary traitor trac- 
ing schemes up to constant factors. Letting q = 0(c 1-7 ) 
for some 7 > 0, we get asymptotic codelengths of I = 
(n 2 + 0(c~ 7 / 3 ))c 1+7 ln(n/ei), improving upon the code- 
lengths (and alphabet size) of Berkman et al. [ 1 1 for large c. As 
7^0, these codelengths also approach the asymptotic code- 
lengths of Fiat and Tassa Q. 

The outline of the paper is as follows. In Section [2] we 
describe the divide-and-conquer technique to build schemes 
with larger alphabets from schemes with smaller alphabet sizes. 
Then, in Section [3] we apply the results to the binary dynamic 
Tardos scheme to obtain an efficient q-ary dynamic Tardos 



scheme, and we compare our results with previous results from 
the literature. Finally, in Section [4] we give a brief summary 
and discussion of the results, and we mention some directions 
for future research. 

2 Construction 

First, let us assume that for a given alphabet size qo, we have 
some construction mechanism S qo for generating qo-ary dy- 
namic traitor tracing schemes (consisting of a code X and a 
tracing algorithm a) for any given maximum number of collud- 
ers c, total number of users n, and for given upper bounds £\ 
and £2 on the false positive and false negative error probabili- 
ties respectively. Now, to efficiently combat collusion attacks 
with an alphabet of size q = 2qo, we follow a two-stage pro- 
cess. First, we divide (see Subsection [XT) the colluders in two 
groups of roughly equal size, and generate qo-ary traitor tracing 
schemes for each group separately. Then we show how to com- 
bine these codes, such that we can conquer (see Subsection l2.2t 
the whole coalition using short q-ary codes. Finally, in Subsec- 
tion 12.31 we show how to generalize this approach to arbitrary 
divisions, where q — kqo for some k > 2. 

2.1 Divide 

Before we even start thinking about traitor tracing schemes, we 
consider the following problem: How can we divide the set of 
users U in two groups , U^ 2 \ such that each group contains 
the same number of colluders? Since we have no idea which of 
the users are the colluders, it is impossible to always do this cor- 
rectly. However, if we allow some room for error, this problem 
can be solved quite easily. Assuming n is even, we first ran- 
domly divide the set of users U in two groups f/W and of 
size n/2. Let the number of colluders in each group be denoted 
by for t = 1,2. Then, the number of colluders C^ 1 ' in 
follows a hypergeometric distribution, i.e., we are taking 
n/2 samples from a population of size n with c successes with- 
out replacement. To prove that both groups contain roughly the 
same number of colluders, note that max t= i 2 > c/2 + a 
if and only if \C^ — c/2| > a. To bound the probability of 
the latter event, we apply a result of Chvatal |6|, which is very 
similar to Chernoff 's bound for estimating tail probabilities 
of binomial distributions. For arbitrary values of a > 0, we get 

p(c-d) > £ +a ) < e - 2a ^ c . (1) 

Furthermore, by symmetry we have P(\C^ — f | > a) = 
2P(CW > f + a). So for any e 2 > and a 2 = yfbx£, 
we can take a = a 2 \f\ to get 

p( es c«>! + *,/|)<e. 

Hence, each group contains n/2 users in total, and with prob- 
ability at least 1 — ^ each group contains at most | + a 2 
colluders. 

After splitting the users in groups, for each group t — 1,2, 
we independently generate a qo-stry dynamic traitor tracing 
scheme (X^>, crW), using S qo . For each scheme, we use a dif- 
ferent set of qo symbols, e.g., the symbols = {0, . . . , qo — 
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1} for and = {q , . . . , q - 1} for U (2 \ The param- 
eters to use for generating these schemes are given below: 

Here, is the number of colluders the scheme for t/W should 
be resistant against, etc. This leads to two code matrices X^ 1 ' 2 ^ 
with respective codelengths £^' 2 \ and two tracing algorithms 

a^ 2 l 

2.2 Conquer 

Having finished the preprocessing, we now show how to weave 
the two <7o-ary codes X^ 1 ' 2 ^ and tracing algorithms ct^ 1,2 ) into a 
single g-ary code X and tracing algorithm a. We start by setting 
i = i' 1 ) = i' 2 ' = 1, where i denotes the current position in the 
code X, and it 1 ' 2 ) denote the current positions in X^' 2 \ 

Now, at each position i and for both t — 1, 2, we send to 
each user j G his ith symbol Xjj = X® w G Q (t) . If 
j(t) > ^(*) ; we expect to have caught all colluders in group L/"W 
already, so we then assign all users in £A*J the empty finger- 
print, denoted by A. 

Then, after sending the ith symbols to all users, the coalition 
chooses an output symbol y^. The distributor then detects this 
forgery, and does the following. 

• If yi G we apply to j/j and the users in U^ x \ 
This may involve calculating accusation scores, discon- 
necting users etc. For users in U^ 2 \ nothing happens. 
When this is done, we increase v l > by 1. 

• If yi G Q^ 2 \ we apply to t/j and the users in U^ 2 \ 
For users in , we do not do anything. Afterwards, we 
increase by 1. 

• If yi — A, we terminate, and we say the scheme has failed. 

Finally, we increase i by 1 and we start with sending the new 
round of symbols to the users. This continues until either 
i > £^ + £^ 2 \ or no pirate output is detected anymore and all 
colluders are caught. Theorem[T] tells us that when the scheme 
terminates, with high probability we will be in the latter sce- 
nario. 

Theorem 1. Let the q-ary traitor tracing scheme be constructed 
as described above. Then, with probability at most Si at least 
one innocent user is caught, and with probability at most £2 
not all pirates are disconnected after at most £ = -f ^( 2 ) 
segments. 

Proof. First, note that for innocent users, nothing really 
changes compared to the original g-ary scheme. For innocent 
users j G U^> (for some t = 1,2) and positions i where 
Hi £ Q i the accusation algorithm does not do anything, so 
we only have to consider the positions i where yi G On 
these positions, we use the algorithm a^' as in the original qo- 
ary scheme. But for the original scheme we know that if we 
use at most v-*> symbols, the probability that no innocent users 
in group t are accused is at least 1 — e^. So the probability 



that none of the innocent users in any group is disconnected is 
at least (1 — )(1 — ) > 1 — e±, as was to be shown. 

For guilty users, we also use a reduction-argument to prove 
that with high probability, all colluders are caught. First, with 
probability at least 1 — # the number of colluders in each group 
is bounded from above by | + ct2 •v/J . If this is indeed the case, 
then the analysis of the original schemes tells us that after at 
most £w positions, with probability at least 1 — ^ all colluders 
in any one of these groups is caught. Since at each segment, 
either v 1 ^ or increases, at some point one of them, say t™, 
will exceed £W. Then we know that we will have caught all 
colluders with probability at least 1 — So the only remain- 
ing active colluders are in the other group for which we 
also know that with probability at least 1 — we will catch all 
colluders before f(* ) exceeds £(* \ So with probability at least 
(1 — 4?)(1 — ^f) 2 > 1 — E2, the division and both schemes are 
successful, and we will catch all pirates after at most (S 1 ' + £^ 
symbols. □ 

It follows that if we have a construction mechanism S qo that 
produces schemes with codelengths £ qo (c,n, 61,82) quadratic 
in c, then the divide-and-conquer technique provides us with 
g-ary schemes (with q = 2qo) achieving codelengths of 

n , \ n« ( c fc n e\ e 2 \ 

£q{c,n,ei,£ 2 ) = 2£ qa ( 2 +a2 V 2' 2'T'T/ 

~ 2 ^o (^,n,£x,e 2 >l j ~ -£ qo {c,n,e 1 ,e 2 ). 

So the codelength decreases by a factor of approximately 2, 
while the alphabet size increases by the same factor 2. 

2.3 Arbitrary divisions 

For simplicity, and for explaining the divide-and-conquer tech- 
nique, in Subsection l2.1l we divided the set of users in 2 groups 
of roughly equal size. This can easily be generalized to split- 
ting the users in fc > 2 groups. Then, the division of colluders 
across the groups follows a multivariate hypergeometric distri- 
bution. For simplicity, let us assume that both n and q are di- 
visible by fc, and that q = kqo for some qo. Let us denote the 
random variable describing the distribution of colluders among 
the groups by a vector C = (C (1 \ . . . , C (fc) ), with C (t) be- 
ing the number of colluders assigned to group Then, for 
each t, the random variable follows a hypergeometric dis- 
tribution with mean % and variance < %. Using similar bounds 
from large deviations theory, one can show that for any £2 > 
and for any number of groups fc, the probability that the largest 
number of colluders in any group exceeds its mean % by more 

than afe oc ^/ln |^ times is small: 

P ( max CM > £ + aJfh < f* 
\i<t<k fc V k J 2 

So after splitting the users in fc groups of size we know that 
with probability at least 1 — 4? each group contains at most 
§ + afc v¥ colluders. Then, for each group we independently 
generate qo-ary traitor tracing schemes {X^\a^) using S qo , 
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with parameters 

The probability that the splits go well and the tracing of traitors 
in each group goes well, is at least (1 — t^)(1 — §f) 2fe > 1 — £2- 
The conquer-phase can then analogously be generalized to k 
groups, weaving k codes X^ 1, '"' k ' together to a big code X. 
We then end up with a q-ary traitor tracing scheme with the 
following properties. 

Theorem 2. Let the q-ary traitor tracing scheme be as de- 
scribed above. Then, with probability at most E\ at least one 
innocent user is caught, and with probability at most £ 2 not all 
pirates are disconnected after at most I — X)t=i ^ segments. 

So if we can construct qo-ary schemes with codelengths 
£ qo (c,n, £i,£ 2 ) quadratic in c, then the divide-and-conquer 
technique provides us with q-ary schemes (q = kqo) with code- 
lengths 

~ kl qo ^,n,£i,£ 2 ) ~ -j-iq (c, n,ei,e 2 ) ■ 

So the codelength decreases by a factor of approximately k, 
while the alphabet size increases by the same factor k. In par- 
ticular, using a binary scheme with a codelength of l 2 quadratic 
in c as a starting point, the divide-and-conquer strategy provides 
us with q-ary traitor tracing schemes with codelengths £ q (c) sat- 
isfying 

2 

£ q (c,n,e 1 ,£ 2 ) w -4(c, n, et, e 2 ). (2) 

Remark 

For explaining the divide-and-conquer method, we assumed the 
smaller codes X^' were generated in advance, i.e., during the 
divide-phase. This is not necessary, as one could also gener- 
ate the new symbols for users on the fly, once they are needed. 
In practice, one may not want to generate all codewords in ad- 
vance, but let them depend on the previous pirate ouput. Then, 
only when yi-t £ Q^ 1 for some t is known, the distributor 
generates new symbols for users j G U^K This means that 
this divide-and-conquer method works for any probabilistic dy- 
namic traitor tracing scheme, even when the codewords cannot 
be generated in advance. 

3 The q-ary dynamic Tardos scheme 

Recently, Laarhoven et al. ifTTl showed that one can efficiently 
turn the binary static Tardos scheme fl4l . or any variant thereof 
lfl2l l2l [T0l . into a dynamic scheme that is able to catch all col- 
luders with a codelength that is quadratic in c. More precisely, 
for q = 2 and parameters c, n, et, £ 2 , one can create schemes 
(X, a) with codelengths L 2 satisfying 

L 2 (c,n,et,e 2 ) = + (^X\ c 2 ln . (3) 



Using this construction as our "base construction" £2, the 
divide-and-conquer construction allows us to construct q-ary 
dynamic Tardos schemes with the following codelengths L q . 

Theorem 3. For arbitrary (even) q, we can construct q-ary dy- 
namic Tardos schemes with codelengths L q given by 

L q (c,n,e 1 ,e 2 )=(^ + o(^^jln(^-Y (4) 

Proof. Let q = 2k be even. Then, combining Equation (0) with 
Theorem|2l we get 



L q (c,n,ei,s 2 ) 




□ 

Asymptotically, the codelengths L q in Equation (O are a fac- 
tor qj 2 shorter than the codelengths of the binary dynamic Tar- 
dos scheme. These codelengths also match the static finger- 
printing capacity as obtained by Boesten and Skoric [3| and 
Huang and Moulin [8|, up to a constant factor. Since we are 
considering a dynamic setting, this does not mean that these 
codelengths are optimal, but it does show that converting any 
q-ary static Tardos scheme to a dynamic q-ary Tardos scheme 
via Laarhoven et al.'s construction of [11] will at best lead to 
the same asymptotic codelengths. Figure Q] shows variants of 
the Tardos scheme, and ways to construct them. To construct 
a q-ary dynamic Tardos scheme from the optimal binary static 
Tardos scheme of Laarhoven and De Weger iflOl . one has to 
(i) make the scheme dynamic, and (ii) go from a binary to a 
q-ary alphabet. First applying (ii) from Skoric et al. [12| and 
then applying (i) using the construction of Laarhoven et al. 
IfTTl leads to codes that are a factor O(lnq) • 0(1) = O(lnq) 
shorter. We showed that first applying (i) using the construction 
of Laarhoven et al. [11] and then applying (ii), we get codes 
that are a factor 0(1) • 0(q) = 0(q) shorter. 

3.1 Large-g asymptotics 

Instead of considering the asymptotic behaviour of fixed q and 
large c, one could also consider the asymptotic behaviour of 
large q and c. As one can see in Equation the first order 
term is only small if q/c is small, so as long as q = o(c) one can 
easily extend Theorem[3]to large q. This leads to the following 
corollary. 
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binary static Tardos 



O(lnq) 
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g-ary static Tardos 



O(l) 
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binary dynamic Tardos 



0(9) 



(this work) 



g-ary dynamic Tardos 



Figure 1: Known variants of the Tardos scheme, and a comparison of their 
asymptotic codelengths. For static Tardos schemes, current methods to con- 
struct g-ary schemes [12] lead to codelengths that are a factor O(lng) shorter 
than binary schemes. For dynamic Tardos schemes, we showed that with the 
divide-and-conquer approach, the codelength decreases by a factor of O(q). 
From any static Tardos scheme, one can obtain a dynamic Tardos scheme with 
the same alphabet size and the same order codelengths [ X 1 J - 



Corollary 1. Let q = O^ 1 " 7 ) for some < 7 <C 1. Then 
by Theorem\3\ we can construct q-ary dynamic Tardos schemes 
achieving asymptotic codelengths of 



L q (c, n, £l , e 2 ) = (vr 2 + 0(c^ 3 )) c 1+7 In (j^ 



(5) 



For 7 — s> 0, we get alphabet sizes q almost linear in c, so it 
makes sense to compare this construction to the deterministic 
schemes of Fiat and Tassa [7 1 and Berkman et al. [ 1 1. The opti- 
mal scheme of Berkman et al. uses an alphabet size of q = c+1, 
and uses a codelength of £ q (c, n) = 0(c 2 + c\og 2 n). For large 
c, this scheme therefore requires longer codes than the g-ary 
dynamic Tardos scheme. The scheme of Fiat and Tassa uses an 
alphabet of size q = 2c + 1, and requires a codelength of only 
£ q (c,n) = c\og 2 n + c. Our scheme approaches this asymp- 
totic codelength as 7 — > 0, but the constants of our scheme are 
larger, and of course Fiat and Tassa's scheme is deterministic. 
So, if one can afford using an alphabet of size q = 2c + 1, Fiat 
and Tassa's scheme is clearly the way to go, but for lower val- 
ues of q, the g-ary dynamic Tardos scheme seems to be the best 
asymptotic scheme known so far. 

3.2 The universal Tardos scheme 

Besides the dynamic Tardos scheme, Laarhoven et al. [11 Sec- 
tion V] also show how to efficiently catch coalition of a pri- 
ori unknown sizes c, using a variant of the dynamic Tardos 
scheme known as the universal Tardos scheme. With slightly 
longer codelengths and maintaining multiple accusation scores 
per user, one can guarantee that small coalitions are caught 
much faster. The divide-and-conquer construction can trivially 
be applied to this variant as well, where the difficulty of bound- 
ing the number of colluders in each group even disappears. One 
simply divides the set of users in k groups, and assigns the pa- 
rameters (n, £1, £2)'*' = (f-, tt, 7?-) to each group. Then, one 
can easily show that the scheme will catch any coalition with a 
codelength quadratic in the actual number of colluders. 



4 Summary 

We have shown that with the divide-and-conquer approach, we 
can obtain schemes for alphabet sizes q = kqo which have 
codelengths approximately equal to the sum of k times the 
codelength of a go-ary traitor tracing scheme. Applying this 



to the binary dynamic Tardos scheme of Laarhoven et al. ifTTl . 
this leads to codelengths which are quadratic in the number of 
colluders c and decreasing linearly in the alphabet size q. Thus, 
the codelengths of this construction match the q-ary static fin- 
gerprinting capacity of Boesten and Skoric [3| and Huang and 
Moulin [8 1, up to a constant factor. For q growing almost lin- 
early in c, the codelengths approach the asymptotic codelengths 
of the deterministic scheme of Fiat and Tassa [7|, and improve 
upon the codelengths of the deterministic schemes of Berkman 
etal. El. 

There are several interesting open problems for future re- 
search in this area. We mention some below. 



4.1 The capacity of the dynamic fingerprinting 
game 

To the best of our knowledge, no one has yet investigated 
whether the fingerprinting capacity game can be extended to 
the dynamic traitor tracing setting. Above, we compared our 
codelengths obtained from the dynamic Tardos scheme to the 
static fingerprinting capacity, but it would be more interesting 
to be able to compare these codelengths to (bounds on) the dy- 
namic capacity. The above construction does make a start in 
this direction, by showing that the g-ary dynamic fingerprinting 
capacity is at least a factor q/2 higher than the binary dynamic 
fingerprinting capacity. 

4.2 The g-ary static Tardos scheme 

Skoric et al. fPH gave a construction for g-ary Tardos codes, 
which are roughly a factor O(lng) shorter than binary Tardos 
codes. It would be interesting to see if it is possible to some- 
how generate static g-ary Tardos codes which are a factor O(q) 
shorter and approach the g-ary fingerprinting capacity. With the 
dynamic Tardos construction of Laarhoven et al. ifTTIl and our 
current results, this may then also lead to better dynamic traitor 
tracing schemes. 

4.3 Application to different schemes 

Above we showed that our construction can be applied to the bi- 
nary dynamic Tardos scheme, but we can also apply our results 
to go-ary dynamic Tardos schemes, or a completely different 
binary dynamic traitor tracing scheme. If someone finds better 
binary dynamic schemes, combined with our construction this 
would immediately lead to better g-ary dynamic traitor tracing 
schemes. 

4.4 Variants of the divide-and-conquer con- 
struction 

One can think of many variants of the divide-and-conquer 
scheme, but these seem harder to analyze. For example, instead 
of using disjoint sets of symbols for each group, one could let 
the different alphabets overlap in a few symbols. Or, instead of 
always using the same division of colluders in groups, one may 
want to redo the division of users in groups for every position, 
or every time a user is disconnected. Analyzing these variants 
may lead to further improvements. 
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